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DETAILED ACTION 

Claim Objections 

Claims 11 and 13 are objected to because of the following informalities: Claim 
1 1 recites receiving "an user input." The Examiner suggests changing this to "a user 
input." Claim 13 recites, "logging an even." The Examiner suggests changing this to 
"logging an event." Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 15-19 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. The Applicant claims a "service" which is 
neither process, machine, manufacture or composition of material. 

Claims 20-22 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. The subject matter of Claims 20-22 claim 
software per se. 



Claim Rejections - 35 USC § 102 
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The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

Claims 15-17 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Naslund. 

Regarding Claim 15, 

Naslund teaches a method which operates to analyze the operation of software 
in a remote protected processing environment, the service including: 

receiving from the remote protected processing environment an encrypted file of 
substantially-constant size representing log entries of selected events which occurred at 
the remote protected processing environment; 

determining a decrypting key for the encrypted file and decrypting the log file; 
analyzing the log entries of selected events at the remote processing environment and 
determining whether the operation of the protected processing environment is 
appropriate; and reporting the results of the analyzing step. 
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In Paragraph [0081] Naslund writes "the security operation unit then comprises a 
public key. The encrypted usage information can then only be ready by the trusted party 
using its private key for decryption of the cryptographically protected information." 

Regarding Claim 16, 

Naslund teaches a method providing the steps of claim 15 and further including 
providing an instruction to initiate the logging of messages and an instruction to send to 
the log file to the remote location for analysis. 

The logging agent (Fig. 2, 150) inherently requires an initializing mechanism to 
determine when the logging is to begin. The logging agent is capable of sending the log 
file to the remote location for analysis, as shown in Fig. 1 . 

Regarding Claim 17, 

Naslund teaches a method providing the steps of claim 16 wherein the 
instruction to initiate logging of messages includes the step of initiating programming 
within the remote system to replace information in a log file with encrypted information 
relating to the operation of the remote system. 

In Paragraph [0079] Naslund writes, "The logging agent comprises a generator for 
generating usage information concerning usage of digital content." In Paragraph [0081] 
Naslund writes that the "encryption engine is arranged for encrypting the usage 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 

USPQ 459 (1966), that are applied for establishing a background for determining 

obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 



Claims 1-2, 4-9, 18 and 20-22 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Naslund (US 2005/0246282) in view of Bhat (US 2003/0055809). 



Regarding Claim 1, 
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Naslund teaches a system that allows analysis of software running in a tamper- 
resistant environment, the system comprising: 

a processor which monitors activities and creates a log entry for at least one of a 
set of selected activities; (Fig. 2, Media processor, 340) 

an encryption system which encrypts the log entry for the at least one selected 
activity; a log of a relatively-fixed size which stores the encrypted log entries; (Fig. 5, 
Security Operation Unit, 160). Fig. 6 shows the log of relatively constant size which stores 
the encrypted log entries. 

However Naslund does not teach random data in the log file when it is originally 
created and which is replaced by log entries so that the size of the log containing log 
entries appears to be a substantially-constant size; 

and a pointer which identified the next storage location for the next log entry so 
that the last log entry can be determined and the next log entry can be positioned in a 
location in the log after the previous log entry. 

Bhat teaches random data in the log file when it is originally created and which is 
replaced by log entries so that the size of the log containing log entries appears to be a 
substantially-constant size; ("Creating the new log record may include.. .using 
a. . .pseudorandom process that creates a unique signature" Paragraph [0077].) ("all log records 
are placed in the same log file until it has reached maximum capacity" Paragraph [0076]). The 
Examiner interprets maximum capacity as the substantially constant size. 
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and a pointer which identified the next storage location for the next log entry so 
that the last log entry can be determined and the next log entry can be positioned in a 
location in the log after the previous log entry, ("additionally, logging service 141 may also 
access last record offset 312 to obtain the pointer to the end of log file 145 in order to allow the 
new log record to be directly placed at the end of the last log record in the log file. " Paragraph 
[0076]) . 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the system of Naslund with the teachings of Bhat. 

The motivation to combine the system of Nasland with the teachings of Bhat is 
that Bhat teaches a way to create a new log record and a way of pointing to the next log 
entry. 

Regarding Claim 2, 

Naslund and Bhat teach a system including the elements of claim 1 wherein the 
system includes a transmission system for sending the log file, upon command, to a 
secure processing location away from the system in which the log file was created, ("the 
now generated and authenticated usage information is then stored as a log entry in a log, either 
arranged in the client system or provided externally by a trusted party" Paragraph [0015] of 
Naslund) 

The Examiner interprets that storing the log file externally inherently requires a 
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transmission system. The Examiner interprets the secure processing location away from 
the system as the trusted party. 

Regarding Claim 4, 

Naslund and Bhat teach a system including the elements of claim 1 wherein the system 
includes a mechanism for obscuring the activity for which a log entry is created. 
Naslund describes "In this embodiment, and encryption engine for cryptographically 
preventing unauthorized access to the generated usage information from the logging 
agent is provided in the security operation unit" (Paragraph [0080]). 

Regarding Claim 5, 

Naslund and Bhat teach a system including the elements of claim 4. 

Naslund and Bhat do not explicitly teach the mechanism for obscuring the activity 
for which a log entry is created includes a printing function for writing into the log file. 
The Examiner takes Official Notice that a printing function for printing the file is well 
known in the art. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to print the log file using the system of Naslund and Bhat. 
The motivation is to write the log information onto paper. 
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Regarding Claim 6, 

Naslund and Bhat teach a system including the elements of claim 2 wherein the system 
includes a mechanism for receiving an indication from the user that transmission is 
desired and transmits the file in response to that indication. 

In Fig. 1 of Naslund, the Client 10 orders the digital content from the Network 
Operator 20. The Network Operator then sends the Client a ticket. The Examiner 
interprets the Client as the user. The Examiner interprets the ordering of digital content 
as a sign that transmission is desired. 

Regarding Claim 7, 

Naslund and Bhat teach a system including the elements of claim 1 wherein the system 
further includes a mechanism for receiving an input from a user that initiates logging of 
log entries into the log. 

Naslund in Paragraph [0067] writes "The module 10 comprises an input/output 
(I/O) communication unit 1 10 for managing communication between the client module 
10 and external units, including the content provider." 
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Naslund and Bhat teach a system including the elements of claim 1 wherein the system 
further includes an initializing mechanism for determining when logging is to begin and 
initiating logging of log entries only in response to that initializing mechanism. 

The logging agent inherently requires an initializing mechanism to determine 
when the logging is to begin. 

Regarding Claim 9, 

Naslund and Bhat teach a system including the elements of claim 1 wherein the system 
uses a public key to provide the log entries and a private key corresponding to the 
public key is used to decrypt the entries at a secure location. ("The security operation unit 
160 then comprises a public key of a trusted party together with a certificate on the public key. 
The encrypted usage information can then only be read by the trusted party using its private 
key" Paragraph [0081]) 

Regarding Claim 18, 

Naslund teaches a method providing the steps of claim 17. 
Naslund does not teach wherein the step of replacing data in the log file includes 
the step of replacing random data which was placed in the log file when it was created. 
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Bhat teaches the step of replacing data in the log file includes the step of 
replacing random data which was placed in the log file when it was created. ("Creating 
the new log record may include . . .using a . . .pseudorandom process that creates a unique 
signature" Paragraph [0077]. It is inherent that the random data will be replaced once the 
first log file is created. 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the method of Naslund with the teachings of Bhat. 

The motivation to combine the system of Nasland with the teachings of Bhat is 
that Bhat teaches a way to create a new log record 

Regarding Claim 20, 

Naslund teaches a device comprising: 

a first module including stored program instructions for recording events (Fig. 3. , 
Logging Agent Application 24) 

a second module for encrypting the recording of events using a key; (Fig. 5, 
Security Operation Unit 160) 

a third module for recording the encrypted events sequentially in a storage block 
of a substantially fixed size; (Fig. 6, Log 170) 

a fifth module for responding to a command and sending the encrypted log file to 
a remote location for decryption and analysis. (Fig. 3. I/O Communication unit 110, 22) 
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Naslund does not teach a fourth module maintaining a pointer of the next 
available location for the log; 

Bhat teaches a fourth module maintaining a pointer of the next available location 
for the log. Bhat writes that ("additionally, logging service 141 may also access last record 
offset 312 to obtain the pointer to the end of log file 145 in order to allow the new log record to 
be directly placed at the end of the last log record in the log file, " Paragraph [0076]) . 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the system of Naslund by including a fourth module as suggested 
by the teachings of Bhat. 

The motivation to combine the system of Nasland with the teachings of Bhat is 
that Bhat teaches a way of pointing to the next log entry. 

Regarding Claim 21, 

Naslund and Bhat teach the elements of claim 20. 

The cited elements of Naslund and Bhat do not teach wherein the software 
further includes: a mechanism for initializing the storage block of a fixed size with 
random information which has been encrypted to provide a block of apparent data. 

Bhat teaches a mechanism for initializing the storage block of a fixed size with 
random information which has been encrypted to provide a block of apparent data. 



Application/Control Number: 10/750,517 Page 13 

Art Unit: 2112 

("Creating the new log record may include. . .using a.. .pseudorandom process that creates a 
unique signature" Paragraph [0077]. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the system of Naslund with the teachings of Bhat. 
The motivation to combine the system of Nasland with the teachings of Bhat is that Bhat 
teaches a way to create a new log record. 



Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over Naslund 
in view of Bhat as applied to claims 1-2 above, and further in view of Danknick (US 
5828864). 

Regarding Claim 3, 

Naslund and Bhat teach a system including the elements of claim 1. 

However Naslund and Bhat do not explicitly teach that the system includes a 
system for wrapping around and filling the log from the beginning when the log file has 
been filled, allowing the log file to remain at a substantially-constant size even after the 
log file has been filled with data and a new entry is received. 

Danknick teaches that "If the log file is filled, new log data will merely wrap 
around in the storage area of the memory replacing old log data with new log data" 
(Column 33, lines 6-11). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the combined system of Naslund and Bhat with the teachings of 
Danknick. 

The motivation to combine the system of Naslund and Bhat with the wrapping 
around method is to provide a solution for writing once the log file is filled. 

Claims 10-14, 19 and 22 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Naslund in view of Bhat and Danknick (US 5828864). 

Regarding Claim 10, 

Naslund teaches a method of analyzing the operation of software in a tamper- 
resistant environment comprising the steps of: 

monitoring the operation of software within the tamper-resistant environment and 
generating messages in response to operation of the software within the tamper- 
resistant environment; ('The invention refers to monitoring usage of digital content 
provided from a content provider over a network to a client system" Abstract) 

logging an event relating to a generated message with an encrypted record of an 
event; (Fig. 5 shows a logging agent 150 encrypting the data before storing it to the 
internal log) 
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and sending the log to a secure location where it may be decrypted and 
analyzed; and analyzing the decrypted data and providing information on the operation 
of the software in the tamper-resistant environment, ("the now generated and authenticated 
usage information is then stored as a log entry in a log, either arranged in the client system or 
provided externally by a trusted party" Paragraph [0015]) 

Naslund does not teach generating a log file full of random data; 
turning on logging and establishing a pointer for the location of the next logged event; 

moving the pointer when a log entry has been made to the next available log 
position; wrapping the pointer to the top of the file when the log is full of log entries; 

Bhat teaches generating a log file full of random data; ("Creating the new log record 
may include... using a... pseudorandom process that creates a unique signature" Paragraph 
[0077]. ("all log records are placed in the same log file until it has reached maximum capacity" 
Paragraph [0076]). 

Bhat further teaches turning on logging and establishing a pointer for the location 
of the next logged event; 

moving the pointer when a log entry has been made to the next available log position; 
("additionally, logging^service 141 may also access last record offset 31 2 to obtain the pointer to 
the end of log file 145 in order to allow the new log record to be directly placed at the end of the 
last log record in the log file." Paragraph [0076]) 
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It Would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the system of Naslund with the teachings of Bhat. 
The motivation to combine the system of Nasland with the teachings of Bhat is that Bhat 
teaches a way to create a new log record. 

The combined teachings of Naslund and Bhat however do not teach teaches 
wrapping the pointer to the top of the file when the log is full of log entries 

Danknick teaches wrapping the pointer to the top of the file when the log is full of 
log entries; Danknick writes "If the log file is filled, new log data will merely wrap around 
in the storage area of the memory replacing old log data with new log data" (Column 33, 
lines 6-11). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the combined system of Naslund and Bhat with the teachings of 
Danknick. 

The motivation to combine the system of Naslund and Bhat with the wrapping 
around method is to provide a solution for writing once the log file is filled. 



Regarding Claim 1 1 , 
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The three references described above teach a method including the steps of claim 10 
wherein the step of turning on logging includes the steps of receiving an user input that 
logging is desired and initiating the logging in response thereto. 

In Paragraph [0071] of Naslund, Naslund writes "In addition, the generated 
usage information may be sent upon a request from the content provider and/or the 
network operator. The generated and authenticated usage information may 
be... transmitted to the external log when the memory of the client log is full." 

Regarding Claim 12, 

The three references (Naslund, Bhat and Danknick) teach a method including 
the steps of claim 10 wherein the step of logging an event further includes the steps of 
determining whether the event is to be logged, and if so, determining when to log the 
event to obscure what is being logged. 

In Paragraph [0081] of Naslund, Naslund describes an "encryption 
engine... arranged for encrypting the usage information using an encryption key." The 
Examiner interprets the encryption as an event to obscure what is being logged. It is 
inherent that the logging agent (Fig. 2, 150) will know what event is to be logged. 



Regarding Claim 13, 
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The limitations of Claim 13 are already taught in Claim 10. Therefore Claim 13 is 
rejected for the same reasons Claim 10 is rejected. 

Regarding Claim 14, 

The three references (Naslund, Bhat and Danknick) teach a method including the 
steps of claim 10 and further including the step of receiving a command from a user that 
indicates that sending the log file to a remote location is desired and transmitting the log 
file in response thereto. 

Naslund teaches that ("the now generated and authenticated usage information 
is then stored as a log entry in a log, either arranged in the client system or provided 
externally by a trusted party. " Paragraph [0015]) 

Regarding Claim 19, 

The combined teachings of Naslund and Bhat teach a method providing the 
steps of claim 17 wherein the step of replacing data in the log file includes the step of 
using a pointer to the next location in the log file. Bhat teaches that ("additionally logging 
sen/ice 141 may also access last record offset 312 to obtain the pointer to the end of log file 145 
in order to allow the new log record to be directly placed at the end of the last log record in the 
log file. " Paragraph [0076]) . 
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Naslund and Bhat do not teach that the pointer wraps to the top of the log file 
after the log file has been filled. 

Danknick teaches that the pointer wraps to the top of the log file after the log file 
has been filled. "If the log file is filled, new log data will merely wrap around in the 
storage area of the memory replacing old log data with new log data" (Column 33, lines 
6-11). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the method of Naslund and Bhat with the teachings of Danknick. 

The motivation to combine the system of Naslund and Bhat with the wrapping 
around method is to provide a solution for writing once the log file is filled. 

Regarding Claim 22, 

Naslund and Bhat teach the elements of claim 20 wherein the software further 
includes a module for writing the encrypted recorded events in a sequential order in the 
fixed-size storage. 

Naslund and Bhat do not teach wrapping around when the end of the fixed-size 
memory is reached. 

Danknick teaches wrapping around when the end of the fixed-size memory is 
reached. Danknick writes "If the log file is filled, new log data will merely wrap around in 
the storage area of the memory replacing old log data with new log data" (Column 33, 
lines 6-11). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine the combined system of Naslund and Bhat with the teachings of 
Danknick. 

The motivation to combine the system of Naslund and Bhat with the wrapping 
around method is to provide a solution for writing once the log file is filled. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Harris C. Wang whose telephone number is 
5712701462. The examiner can normally be reached on M-F 7:30-5, Alternate Fridays 
Off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Walter Griffin can be reached on 5712721497. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

WALTER D. GRIFFIN 

HCW SUPERVISORY PATENT EXAMINER 



